‘Nobody understands outsourcing the management of .nl domains to Amazon’

Setting up a website is easy: you come up with a name like ‘housing.nl’, check whether it is available and request the domain name from your internet provider. The latter registers the name with the Stichting Internet Domeinregistratie Nederland (SIDN, the Netherlands internet domain registration foundation). Next, you get a bill for a handful of euros and half an hour later, anyone typing in ‘housing.nl’ arrives at your website.

Since it was established in 1996, the SIDN database has grown to 6.3 million .nl domain names. It is the national phone book for the internet and it ensures that a domain name is translated into an IP address of a server that your computer or smartphone can communicate with. Without that phone book, much of the Dutch internet would stop working, including critical systems like DigiD (the Dutch national identification app, Ed.)

In early February, SIDN was in the news (in Dutch) after announcing its plans to outsource part of its services to Amazon Web Services, a US web giant. SIDN explained the reason for the outsourcing as being that implementation on its own servers had become too expensive and labour intensive.

Reactions on LinkedIn did not beat around the bush. ‘More innovative by dumping all the technology elsewhere? Good luck with that!’ (Eelco M.); ‘An unimaginably stupid decision’ (Bert Hubert); and, ‘A very bad idea to throw all your belongings into an American cloud’ (Mark Schouten). Delta called Michel van Eeten, Professor of Governance of Cybersecurity at the Faculty of Technology, Policy & Management, for comment.

Do you understand what all the fuss is about?

“Yes, I do. The SIDN is a main player that likes to boast about its special status as part of the critical internet infrastructure. But in reality, it is also a monopolist that feels little competitive pressure. They are not on a shoestring budget, believe me. But if they choose to outsource some of their tasks to an American tech giant anyway, I can understand why people wonder why they ended up doing so.”

What exactly does the SIDN want to outsource?

“The SIDN manages the DNS zone file, the directory of all Dutch internet addresses. There are two sides to this. The SIDN distributes the zone file so that .nl domain names are recognised when you type them on your computer or phone. The other side is its registration system. Hosting companies can apply for, renew or cancel domain names on the registration system. The SIDN wants to transfer this task to Amazon.”

Why is that such a bad thing?

“In part, it is a matter of timing. Five years ago, there would have been far less fuss about it. But in recent years, there has been much more questioning about the wisdom of moving more and more digital services to a handful of US companies. The discussion is about digital sovereignty, which has become quite a thing in Europe.”

Why not choose a Dutch cloud service then?

“That’s the second aspect of the fuss. The SIDN has not given any explanation as to how on earth it ended up with Amazon. I can well imagine that they don’t fancy all that iron (servers, Ed.) and can’t find staff. But there are plenty of Dutch providers who say, ‘Just give it to us. We will take care of everything’.

Can Dutch internet providers compete with Amazon?

“Those big cloud providers have a much larger service offering than European companies. They can scale up very quickly (by adding more servers, Ed.), offer huge storage capacity, authentication , financial services, and so on.

But the question is whether the SIDN really needs all that? And does the SIDN really need to scale up ad infinitum? The decision to go to Amazon seems poorly thought out to me. The SIDN has not given any explanation as to why the registration system needs to go to Amazon.

Nor do I understand why that registration system should be so demanding. In principle, it seems quite simple. I estimate that each database has a few hundred accounts, so I see no reason why a Dutch cloud service could not handle that.”

Should there be legislation so that the internet phone book remains in Dutch hands?

“In general, people have too high expectations of regulation. In this case it is about outsourcing an operationally relevant infrastructure and a public institution like this has an accountability obligation. This is evident from the parliamentary questions (in Dutch) that have been asked.

Others have pointed out that its own statutes (in Dutch) should stop SIDN from doing this. Apparently the SIDN Supervisory Board has been asleep. If you are so tone-deaf to what is happening in the world, I would not be surprised if Parliament initiates legislation to nationalise the SIDN in no time.”